Notes from building LockProof: what actually proves a vendor showed up

Proof a vendor showed up comes down to three things: when the photo was taken, how it was captured, and whether the record changed afterward. A screenshot of a text thread answers none of them.

I learned this building the first version of LockProof for a single property management company. The pattern was always the same: a vendor invoices for a visit, a resident says nobody came, and the manager is stuck arbitrating between two people’s memories. The vendor sends a photo, but a photo proves almost nothing by itself. It could be from last month’s visit. It could be from a different unit. There is no way to tell.

The uncomfortable truth about most “photo proof” is that it is worker-chosen. The worker decides when to shoot, what to shoot, and which photo to send. Documentation apps polish that workflow, but they do not change who controls it.

What actually holds up in a dispute is a record where the worker does not control the conditions:

The request comes from the system, not the worker.A scheduled or randomized prompt takes timing out of the worker’s hands. No shooting everything in one batch on Friday.

The photo comes through a live camera. If the gallery is blocked, the image cannot be an old photo re-uploaded. It had to pass through the camera at that moment.

The timestamp is set by the server, not the phone. Phone clocks can be changed. A server-side timestamp on arrival cannot be edited by anyone in the field.

Location is recorded when the worker shares it. An honest caveat: GPS only proves where the phone was, and only when location was shared. A record should say plainly when location was not captured, rather than pretending it always is.

The record is sealed.A cryptographic hash (we use SHA-256) means any later change to the photo or its details is detectable. That is what “tamper-evident” means. Not that tampering is impossible, but that it cannot happen silently.

One more honest limitation, because it matters: a sealed live photo proves the image came through a camera at a verified time with integrity intact. It does not prove the work was done well. What it eliminates is the recycled-photo dispute and the “were they even there” argument, which in my experience is most of the fight.

That is the standard I would hold any verification system to, including the one I built.

If you want to see what a sealed record looks like, the step-by-step guide to prove a vendor showed up walks through building dispute-ready vendor records, and there is a sample evidence packet on the site.